Breaking Down Mustang Panda’s Windows Endpoint Campaign

Mustang Panda is a persistent, sophisticated espionage-focused APT that has conducted global campaigns since 2012 against think tanks, diplomatic entities, telecoms and government organizations; the report documents its tooling (PlugX, ToneShell, LOTUSLITE, SnakeDisk USB worm), initial access vectors (spearphishing, Azure-hosted lures, USB propagation), defense-evasion/persistence techniques (DLL side‑loading, kernel rootkit, registry modifications, geofencing), and C2 obfuscation methods (Cloudflare proxying, TLS header spoofing, Googlebot/Microsoft headers).